Stop trusting the compromised eMudhra intermediate CAs

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 2.11.2
+
+### Fixed: stop trusting the compromised eMudhra intermediate CAs
+
+- The CLI and every tool in the Docker image now reject certificates issued
+  from the compromised eMudhra intermediate CAs.
+- Bumped `certifi` to `2026.10.19` and the image's bundled `uv` to `0.13.4`.
+
 ## 2.11.1
 
 ### Changed: bump pinned Coana CLI to 15.12.10

Dockerfile

@@ -14,9 +14,14 @@ ARG PIP_EXTRA_INDEX_URL=https://pypi.org/simple
 ARG USE_LOCAL_INSTALL=false
 
 # Install base packages first
+# ca-certificates must be 20261020-r0 or newer, which drops the roots the
+# compromised eMudhra intermediates chain to. The base image ships an older
+# one, and `apk add` does not upgrade installed packages, so upgrade it here.
 RUN apk update && apk add --no-cache \
         git nodejs npm yarn curl wget \
-        ruby ruby-dev build-base strace
+        ruby ruby-dev build-base strace && \
+    apk upgrade --no-cache ca-certificates && \
+    [ "$(apk version -t "$(apk list -I ca-certificates | awk '{print $1}' | sed 's/^ca-certificates-//')" 20261020-r0)" != "<" ]
 
 # Install Go with version control
 RUN if [ "$GO_VERSION" = "system" ]; then \
@@ -84,9 +89,13 @@ RUN npm install socket -g && \
 # Set environment paths
 ENV PATH="/usr/local/go/bin:/usr/lib/go/bin:/root/.cargo/bin:${PATH}"
 ENV GOPATH="/go"
+# Node's bundled CA store still trusts the compromised eMudhra intermediates and
+# no patched Node release exists yet. Use the system store, which ca-certificates
+# above already fixed. Drop this once Node ships its fix.
+ENV NODE_OPTIONS="--use-openssl-ca"
 
-# Install uv
-COPY --from=ghcr.io/astral-sh/uv:0.10.4 /uv /usr/local/bin/uv
+# Install uv (0.13.4+ ships the patched webpki-roots)
+COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv
 
 # Install pyenv
 # pyenv lets us build/install arbitrary Python versions on demand. We install

pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.11.1"
+version = "2.11.2"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [

scripts/docker-entrypoint.sh

@@ -7,6 +7,14 @@
 # Set GOROOT from the value determined at build time
 export GOROOT=$(cat /etc/goroot)
 
+# Keep Node on the system CA store (see NODE_OPTIONS in the Dockerfile) when the
+# caller sets their own NODE_OPTIONS, e.g. a heap limit. Leave an explicit CA
+# store choice alone, since Node rejects conflicting CA flags.
+case " ${NODE_OPTIONS:-} " in
+    *" --use-openssl-ca "*|*" --use-bundled-ca "*|*" --use-system-ca "*) ;;
+    *) export NODE_OPTIONS="--use-openssl-ca${NODE_OPTIONS:+ $NODE_OPTIONS}" ;;
+esac
+
 # Check if we have any arguments
 if [ $# -eq 0 ]; then
     # No arguments provided, run socketcli with no args (will show help)

socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.11.1'
+__version__ = '2.11.2'
 USER_AGENT = f'SocketPythonCLI/{__version__}'